Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#161

Post by FabHK »

paulpauper wrote: post #155
jsnell wrote: post #35

Earlier quoted context omitted.

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch. For most of the world, SMS is it. The Nordic countries have th…

It can reduce security if password can be reset with SMS

That's the whole point of GP:

SMS is perfectly fine as a second factor, and terrible if it can serve as the only one factor.

Re: Tell HN: SMS-based two-factor authentication is not secure

#162

Post by vlovich123 »

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

I got my Uber account taken over this way and I wasn’t using my cell for recovery of anything. SMS is terrible for all these purposes

Re: Tell HN: SMS-based two-factor authentication is not secure

#163

Post by nucleardog »

UncleMeat wrote: post #80
the_snooze wrote: post #28

Earlier quoted context omitted.

SMS is better than nothing, but you have a bunch of other better fallback alternatives before you should rely on it. You can support the enrollment of multiple hardware tokens (i.e., you keep one at home, and one on your person). You can have online push login approvals. You can have a TOTP code generator.

TOTP is the one that makes the least sense to me. It is also weak to phishing (extremely common) but adds protection against SIM-swapping (comparatively very rare). It also has almost all of the downsides of U2F (a pain in the ass if you lose your device).

TOTP has the downsides of U2F, but those downsides are comparatively easier to mitigate.

Put a plan together for the "house burns down" scenario.

With U2F I need to enroll multiple tokens and keep some off-site. So what does this entail? I keep maybe 3 tokens, two on-site that I add the new account to, then on a regular schedule I rotate one off-site and bring the third one on-site and go back through and add it to any accounts I've created in the meantime? The whole process is a pain in the ass, and not all sites allow multiple devices to be registered (e.g., AWS). And new accounts are still vulnerable during the time between registering and rotating the third key on-site.

With TOTP you can... just sync your TOTP database. Some apps such as Microsoft Authenticator do this on their own. Personally, I put all my TOTP secrets into a Keepass database and sync it off-site with Nextcloud. There is no way for the site to limit how many devices I enroll so it's easy enough to create as many backup devices as you need. If you're really old school, you can print the secrets and put them in a fire safe.

FWIW, I have several yubikeys. I primarily use them as a secure store for TOTP secrets and to store a SSH key (generated off-device and backed up), not for webauthn. It's just too annoying to deal with in a way that ensures I don't lock myself out of an account.

Re: Tell HN: SMS-based two-factor authentication is not secure

#165

Post by baybal2 »

staticassertion wrote: post #12
jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

I want warn people about U2F.

U2F is only an authentication tool, not security/encryption one.

If you have your smartphone/browser/pc pwned, you are even more screwed than with offline key table/token.

For something truly security critical, you need security against MITM on your own device, which only leaves smartcards as an option.

Re: Tell HN: SMS-based two-factor authentication is not secure

#166

Post by xphos »

aarreedd wrote: post #164

You can request that your mobile provider put a port freeze and SIM lock on your account and require you to be in-store with a valid photo ID to transfer your number to another device. https://help.coinbase.com/en/coinbase/privacy-and-security/d...

Yeah but if that's not the default 2 factor authentication is not secure and its an illusion of safety. For companies and groups to claim its gives you all this security when it doesn't follow through even in the default case is misleading. No shade on you but your talking about a lot of hops to go thru just to make someones broken model work.

Re: Tell HN: SMS-based two-factor authentication is not secure

#167

Post by kyle-rb »

paulpauper wrote: post #157
eslaught wrote: post #144

Part of the issue here that I don't see people addressing is that SMS as an only-factor recovery tool is often not optional. I hit a case like this just the other day: the service would not allow me to log in at all without adding an SMS number. This is becoming increasingly common. The irony is that my security is now worse. At least my password was randomly generated. I'm not sure what there is to do about this, ot…

that is because google and other companies derive more $ from your number than protecting your privacy/security

Google doesn't require SMS. They often ask me when I log in, but I can always hit 'skip', which I do because I'm scared of this exact case.

Re: Tell HN: SMS-based two-factor authentication is not secure

#168

Post by FabHK »

profsnuggles wrote: post #96
addingnumbers wrote: post #89

Earlier quoted context omitted.

You're describing single factor, not two factor. If you can change the password with SMS alone, it's not multi-factor. I plainly stated that exception two comments ago.

Except you have no way of knowing if that will be the case ahead of time. Unless the first thing you do after enabling 2FA is to social engineer a password reset for your account? Even then that doesn't guarantee that there isn't a more clueless service rep that will make a mistake. Asking before you sign up, "will you allow my account to be hacked through social engineering?" isn't going to an answer other than no.…

But then let's please move the discussion from "Is SMS a good or bad second factor?" to "SMS is a mediocre second factor, and a terrible single factor. For this service, is it a second or single factor?"

Re: Tell HN: SMS-based two-factor authentication is not secure

#169

Post by u801e »

Wowfunhappy wrote: post #22
staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

I really wish that web browsers had worked on the UI for generating certificate signing requests and importing certificates and that websites had 2FA via username/password along with client-side TLS certificate for authentication.

This is more portable than U2F tokens since client-side certificates are part of the TLS standard and should be supported regardless of the application protocol used. Adding other devices could be done by sending a CSR along with the username and password and authorizing the second device from first device that's already logged into the account.

Re: Tell HN: SMS-based two-factor authentication is not secure

#170

Post by dheera »

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

SMS is not a good second factor, even as a second factor.

I deprecated SMS 10 years ago and the only way I receive SMS codes is via an online interface that is password access.

For most people, SMS fails miserably when you need to change your SIM card or fly to another country, or work out of a place with no cell reception but has wired or wi-fi internet access. That's a big part of the reason why I deprecated it in favor of e-mail, which works flawlessly anywhere in the world you have an internet connection.

I only support U2F or TOTP based 2FA and it's upto providers to get with the beat if they want me to use real 2FA.

Post reply on HN